Network segmentation for small business: a VLAN starter plan

Network segmentation means splitting one office network into several separate zones, with a firewall deciding what is allowed to pass between them. A visitor’s phone, a security camera, and a card terminal each sit in their own zone and cannot reach your computers or file server unless a rule specifically permits it. For a small business it is done with VLANs on equipment you may already own, and a sensible starter layout has five zones: staff, guest, IoT and cameras, payment terminals, and servers.

What is a VLAN, in plain English?

A VLAN (virtual local area network) lets one physical switch behave like several separate switches. Each VLAN is its own network with its own range of addresses. Devices in the same VLAN can talk to each other directly. Devices in different VLANs cannot, unless the traffic goes up to the router or firewall, which checks its rules and either passes or blocks it.

Think of an office building with one front door. A flat network is an open-plan floor: anyone who gets in can walk up to any desk. VLANs are separate locked suites off a shared hallway, and the firewall is the person at the hallway desk deciding who may go from one suite into another.

Three practical details:

• Wired devices are placed in a VLAN by configuring the switch port they plug into.
• Wireless devices are placed in a VLAN by the Wi-Fi network name they join. Each network name (SSID) is mapped to a VLAN, so “Office” and “Guest” can come from the same access point and still be separate networks.
• The VLAN itself blocks nothing between zones. The firewall rules do. This is the most common misunderstanding, and we come back to it under common mistakes.

CISA describes segmentation as “a physical or virtual architectural approach dividing a network into multiple segments, each acting as its own subnetwork providing additional security and control”.

What equipment do you need?

1. A router or firewall that supports VLANs and rules between them. Most business models do. Most ISP-supplied and consumer routers do not, beyond a basic guest network.
2. A managed switch (one that can be configured). Unmanaged switches cannot assign ports to VLANs.
3. Access points that support multiple network names mapped to VLANs. Most business access points do.

If you already have business-grade gear from one product family, segmentation is usually a configuration project, not a purchase.

A starter VLAN layout for a small office

The VLAN numbers and address ranges below are examples. Any consistent scheme works.

Zone	VLAN	Example range	What goes here	Allowed to reach
Staff	10	192.168.10.0/24	Company computers and laptops	Internet, servers (specific services), printers
Servers	20	192.168.20.0/24	File server, network storage, backup device	Internet for updates and cloud backup only
Payment	30	192.168.30.0/24	Card terminals, point-of-sale stations	Only the payment processor’s required internet addresses
IoT and cameras	40	192.168.40.0/24	Cameras, recorder, TVs, thermostats, door controllers, printers	Internet only where a device needs it. Nothing internal
Guest	50	192.168.50.0/24	Visitor devices, staff personal phones	Internet only

The rule set behind that table, in plain English:

1. Start from “block everything between zones”.
2. Allow staff computers to reach the file server on the specific services they use (file sharing, the practice software port), not everything.
3. Allow staff computers to reach printers and to view the camera recorder.
4. Allow nothing to start a connection into the payment zone.
5. Allow nothing from guest or IoT to start a connection into staff or servers.
6. Turn on client isolation for the guest Wi-Fi so visitor devices cannot see each other either.
7. Restrict the management pages of the firewall, switches, and access points so only a designated computer or a small management zone can open them.

If you run desk phones, a sixth zone for voice keeps call traffic separate and makes call quality rules simpler. Our VoIP guide covers that.

How does segmentation reduce PCI DSS scope?

If you accept cards, PCI DSS (the Payment Card Industry Data Security Standard) applies to every system that stores, processes, or transmits card data, and to everything connected to those systems. That set of systems is called the cardholder data environment, and the size of it determines how much work compliance is.

The PCI Security Standards Council’s Guidance for PCI DSS Scoping and Network Segmentation is direct on four points:

• Segmentation “is not a PCI DSS requirement”, but it is “strongly recommended” as a way to reduce the scope and cost of assessment and the risk to the organization.
• Without adequate segmentation, which the Council calls a flat network, “the entire network is in scope”.
• “To be considered out of scope, a system component must not have access to any system in the CDE.”
• Where segmentation is used to reduce scope, those controls must be verified, including penetration testing of the segmentation at least annually.

In practice: if your card terminals share a network with the office computers, every one of those computers is in scope. Put the terminals in their own zone with nothing allowed in, and the office computers can fall out of scope.

Two cautions. First, how much applies to you depends on how you take payments. A terminal that connects over its own cellular link, or a validated point-to-point encryption setup, changes the picture. Your payment processor or acquiring bank tells you which self-assessment questionnaire applies, and that is the authority to follow. Second, segmentation done for PCI reasons has to be documented and tested, not just configured. Our PCI DSS guide for small business covers the rest.

Does segmentation stop ransomware?

It limits how far it spreads, which is why CISA’s #StopRansomware Guide lists network segmentation among its preparation steps. An infected guest laptop or a compromised camera cannot reach the file server if no rule lets it.

It is honest to state the limit too. A staff computer has legitimate access to shared folders, so ransomware running on that computer, as that user, can still encrypt the files that user can change. Segmentation does not replace endpoint protection, limited folder permissions, multi-factor authentication, and tested backups. It is one layer of the approach described in our ransomware protection guide.

How to roll it out without breaking the office

1. Inventory. List every device on the network, wired and wireless, and what it needs to talk to. Expect surprises.
2. Design. Assign each device to a zone. Write the rules in plain English first, as above.
3. Build the zones. Create the VLANs, address ranges, and Wi-Fi network names. Leave rules open between zones for now.
4. Move devices in groups, starting with guest and IoT, which are lowest risk. Reserve addresses for printers, the recorder, and terminals.
5. Turn on the blocking rules, one zone at a time, outside business hours.
6. Test from inside each zone. From guest Wi-Fi, try to open the printer’s web page, the camera recorder, and a shared folder. Every attempt should fail. From a staff computer, confirm printing, file access, and camera viewing still work.
7. Document. Keep a one-page map of zones, ranges, and rules. Review it when equipment is added.

Things that commonly break, and the fix

• Printing and screen casting. AirPrint, AirPlay, and Chromecast find devices using a discovery method that does not cross VLANs. Most business gateways have an mDNS or “multicast DNS” option that relays discovery between chosen zones.
• Wireless speakers and TVs controlled from phones have the same discovery issue.
• Card terminals. Processors publish the addresses and ports their terminals need. Get the list before locking the zone down.
• Camera viewing. Staff need a rule allowing them to reach the recorder. The recorder does not need to reach them.

When is this more than you need?

Every office that lets visitors on Wi-Fi should have at least a properly isolated guest network. Beyond that, a very small office with a few laptops, no server, no cameras, and card payments on a standalone cellular terminal gets limited benefit from five zones. Guest plus everything else is a reasonable stopping point until the network grows.

Full segmentation is worth doing when you have payment terminals on the network, cameras or other unattended devices, a server or network storage, regulated data (health, financial, legal), or a cyber insurance questionnaire asking about it.

Common mistakes

• VLANs with no rules. Many routers allow traffic between VLANs by default. Creating the zones without adding block rules changes almost nothing. Test it.
• A “guest” network that is only a second password on the same network.
• Temporary “allow everything” rules added during troubleshooting and never removed.
• Management pages reachable from every zone, including guest.
• Printers left in the staff zone by habit. They are unattended devices that rarely get updates and belong with IoT.
• No documentation, so the next change is guesswork.

Common questions

Is a guest Wi-Fi network the same as segmentation?

It is the simplest form of it, provided the guest network is truly isolated: its own VLAN or equivalent, internet only, with client isolation on. Test it by joining the guest network and trying to open your printer’s or router’s web page. If it loads, the isolation is not working.

Do VLANs slow the network down?

Not noticeably. Traffic within a zone is switched as before. Traffic between zones passes through the firewall, which needs to be sized for it. In a small office the volume between zones (printing, file access, camera viewing) is well within what a business firewall handles.

Can segmentation be added to an existing network?

Yes, if the router, switches, and access points support VLANs. It is normally done in stages without downtime during business hours, with blocking rules switched on after devices have been moved and tested.

Does segmentation make a business PCI compliant?

No. It reduces how many systems PCI DSS applies to, which makes compliance smaller and cheaper. The requirements still apply in full to the payment zone, and the segmentation itself must be tested. Your processor or acquiring bank defines what you must submit.

Where do printers belong?

In the IoT zone, with a rule allowing staff computers to print to them. Printers run their own software, are rarely updated, and often keep copies of documents, so treating them as untrusted devices is the safer default.

How Coastal Growth Co. can help

We design and configure segmented networks for small offices: the device inventory, the zone plan, VLAN and firewall rules, staged cutover, and testing from inside each zone, with a one-page map you keep. It is part of our network, Wi-Fi, and camera services, and scope and price are agreed before work starts. Contact us to describe your current setup, or see how this fits with ongoing managed IT.